Collaborate Disseminate
On this third day, we will focus on application usage. We will cover three databases:KnowledgeC.dbBe sure to check out more detailed information on this database in my two previous articles.Access to this database is limited to a file system dump, it w… Continue reading On the Third Day of APOLLO, My True Love Gave to Me – Application Usage to Determine Who Has Been Naughty or Nice
Grab APOLLO Here!The iOS Health database may be the easiest database to acquire. While other databases need physical file system dumps of the devices, this database can be accessed with an encrypted iOS backup, or possibly an iCloud acquisition. If you… Continue reading On the Second Day of APOLLO, My True Love Gave to Me – Holiday Treats and a Trip to the Gym – A Look at iOS Health Data
I originally released APOLLO at the Objective by the Sea conference in early November. Since then I’ve received a surprising amount of positive feedback about various analysts using this tool or the accompanying SQL queries on their file system dumps t… Continue reading On the First Day of APOLLO, My True Love Gave to Me – A Python Script – An Introduction to the Apple Pattern of Life Lazy Output’er (APOLLO) Blog Series
I saw this article “NYC plans to make AirDropping dick pics a crime” on Friday and it got me thinking. What exactly are the cops going to find if they do an analysis of a device, e… Continue reading AirDrop Analysis of the UDP (Unsolicited Dick Pic)
Testing and forensics go hand in hand. You cannot be sure about a certain artifact on what it contains or what certain pieces mean without testing (and not just once, but over and … Continue reading Do it Live! Dynamic iOS Forensic Testing
I had the privilege and honor to present at the first ever Objective by the Sea Mac Security Conference yesterday in Maui (hardship, right?). It was only the first day and it was absolutely spectacular, I may have to make this one a regular! I can easi… Continue reading Slides and Script! From Apple Seeds to Apple Pie & Introducing APOLLO: The Apple Pattern of Life Lazy Output’er
Heather Mahalik and my presentation of the iOS Health Database from the DFIR SANS Summit this past summer is now up. As always you can find the link to all my presentations, videos, and other resources on mac4n6.com/resources. Continue reading Video Now Available – #DFIRFIT or BUST: A Forensic Exploration of iOS Health Data
iOS devices may potentially have more personal information and user patterns than their macOS counterparts. People tend to go about their daily lives with their mobile devices rarely being separated from them. In this post I will present to you a day i… Continue reading Knowledge is Power II – A Day in the Life of My iPhone using knowledgeC.db
In the spirit of our American holiday Labor Day, where normal people might be watching a parade, barbecuing, and shopping Labor Day deals – I’ve decided to forgo the crowds the mall and give back to the community, monetarily. (BBQ is still fair ga… Continue reading Making it Rain on this Labor Day – Giving Back to the DFIR and Security Communities
Having access to precise and granular user and application usage can be extremely useful in a forensic investigation, some of which are listed here. I find that pattern-of-life dat… Continue reading Knowledge is Power! Using the macOS/iOS knowledgeC.db Database to Determine Precise User and Application Usage